CVE-2026-46300

HighCVSS 7.8/10Known exploited (CISA KEV)Last modified Oct 29, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

net: skbuff: preserve shared-frag marker during coalescing

skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost.

That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags.

Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787CWE-456CWE-123

Affected software

VendorProductVersions
LinuxLinux>= cef401de7be8c4e155c6746bfccf721a4fa5fab9, < 3599e6b3cc1ada96883d496a50a210d3afbb6987; >= cef401de7be8c4e155c6746bfccf721a4fa5fab9, < 2f2b16022a2e10ca7bccfb98db5ed2ec0f72641c; >= cef401de7be8c4e155c6746bfccf721a4fa5fab9, < 9d3e5fd19fe1063bf607219e8562fbd567b8e8d5; >= cef401de7be8c4e155c6746bfccf721a4fa5fab9, < 78bf6b6bb19541d19fbda6242e7cfe2c682763c0; >= cef401de7be8c4e155c6746bfccf721a4fa5fab9, < 760e1addc27ba1a7beb4a0a7e8b3e9ec49e7a34e; >= cef401de7be8c4e155c6746bfccf721a4fa5fab9, < 3bd9e113d50034db99d7ef69fd8e5242d15e414a; >= cef401de7be8c4e155c6746bfccf721a4fa5fab9, < 3884358a9286b17f389a72b1426fc4547c23c111; >= cef401de7be8c4e155c6746bfccf721a4fa5fab9, < f84eca5817390257cef78013d0112481c503b4a3
LinuxLinux3.9
Red HatNVIDIA for RHEL 10—
Red HatRed Hat Enterprise Linux 10—
Red HatRed Hat Enterprise Linux 10.0 Extended Update Support—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support—
Red HatRed Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On—
Red HatRed Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support—
Red HatRed Hat Enterprise Linux 8.6 Telecommunications Update Service—
Red HatRed Hat Enterprise Linux 8.6 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 8.8 Telecommunications Update Service—
Red HatRed Hat Enterprise Linux 8.8 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 8.8 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9.0 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 9.0 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 9.4 Extended Update Support—
Red HatRed Hat Enterprise Linux 9.4 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 9.6 Extended Update Support—
Red HatRed Hat Enterprise Linux 9.6 Extended Update Support—
Red HatRed Hat OpenShift Container Platform 4.12—
Red HatRed Hat OpenShift Container Platform 4.13—
Red HatRed Hat OpenShift Container Platform 4.14—
Red HatRed Hat OpenShift Container Platform 4.15—
Red HatRed Hat OpenShift Container Platform 4.16—
Red HatRed Hat OpenShift Container Platform 4.17—
Red HatRed Hat OpenShift Container Platform 4.18—
Red HatRed Hat OpenShift Container Platform 4.19—
Red HatRed Hat OpenShift Container Platform 4.20—
Red HatRed Hat OpenShift Container Platform 4.21—
Red HatRed Hat OpenShift Container Platform 4.21—
Red HatRed Hat OpenShift Container Platform 4.21—
Red HatRed Hat Enterprise Linux 6—
Red HatRed Hat Enterprise Linux 7—
Red HatRed Hat Enterprise Linux 7—
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP>= V3.1.6, < V3.1.7
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP>= V3.1.5, < *
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP>= V3.1.6, < V3.1.7
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP>= V3.1.5, < *
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP>= V3.1.6, < V3.1.7
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP>= V3.1.5, < *
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP>= V3.1.6, < V3.1.7
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP>= V3.1.5, < *
SiemensSIPLUS S7-1500 CPU 1518-4 PN/DP MFP>= V3.1.6, < V3.1.7

References

Timeline

Published
May 23, 2026
Last modified
Oct 29, 2026
Added to CISA KEV
Oct 28, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-463017.8In the Linux kernel, the following vulnerability has been resolved: spi: topcliff-pch: fix use-after-free on unbind Give the driver a chanCVE-2026-463025.5In the Linux kernel, the following vulnerability has been resolved: selinux: allow multiple opens of /sys/fs/selinux/policy Currently therCVE-2026-463038.2In the Linux kernel, the following vulnerability has been resolved: isofs: validate Rock Ridge CE continuation extent against volume size CVE-2026-463047.5In the Linux kernel, the following vulnerability has been resolved: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free nvmet_tcp_relCVE-2026-463055.5In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: os_dep: avoid NULL pointer dereference in rtw_cbuf_CVE-2026-463067.5In the Linux kernel, the following vulnerability has been resolved: flow_dissector: do not dissect PPPoE PFC frames RFC 2516 Section 7 staCVE-2026-463078.3In the Linux kernel, the following vulnerability has been resolved: wifi: ath5k: do not access array OOB Vincent reports: > The ath5k drivCVE-2026-463087.8In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: fix use-after-free in scpsys_get_bus_protection_legCVE-2026-463097.0In the Linux kernel, the following vulnerability has been resolved: drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madviseCVE-2026-46319.8Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sCVE-2026-463105.5In the Linux kernel, the following vulnerability has been resolved: media: renesas: vsp1: Fix NULL pointer deref on module unload When unlCVE-2026-463117.8In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: fix access to stale wptr mapping Use drm_exec to tak